sdl-mcp 0.9.0 → 0.9.2

package/README.md

@@ -11,11 +11,9 @@
 
 <br/>
 
-![npm version](https://img.shields.io/npm/v/sdl-mcp.svg)
-![npm downloads](https://img.shields.io/npm/dm/sdl-mcp.svg)
-![GitHub Actions Workflow Status](https://img.shields.io/github/actions/workflow/status/GlitterKill/sdl-mcp/ci.yml?label=CI%20Builds)
-![GitHub Actions Workflow Status](https://img.shields.io/github/actions/workflow/status/GlitterKill/sdl-mcp/publish-native.yml?label=Rust%20Indexer%20Builds)
-![GitHub commit activity](https://img.shields.io/github/commit-activity/w/GlitterKill/sdl-mcp)
+![npm version](https://img.shields.io/npm/v/sdl-mcp.svg?style=for-the-badge)
+![npm downloads](https://img.shields.io/npm/dm/sdl-mcp.svg?style=for-the-badge)
+![GitHub commit activity](https://img.shields.io/github/commit-activity/w/GlitterKill/sdl-mcp?style=for-the-badge)
 
 </div>
 
@@ -131,6 +129,12 @@ The core innovation. Named after the adjustable aperture that controls light flo
 | "Show me the shape of `AuthService`" | ~4,000 tok | ~300 tok | **13x** |
 | "Where is `this.cache` set?" | ~2,000 tok | ~500 tok | **4x** |
 
+**Why it matters:**
+- **4–20x token savings** on typical code understanding queries
+- Most questions answered at Rungs 1–2 without ever reading raw code
+- Controlled escalation prevents agents from over-consuming context
+- Policy-gated raw access ensures agents prove they need full source
+
 [Iris Gate Ladder Deep Dive →](./docs/feature-deep-dives/iris-gate-ladder.md)
 
 <br/>
@@ -169,6 +173,12 @@ Every function, class, interface, type, and variable becomes a **Symbol Card**:
 
 Cards include **confidence-scored call resolution** (the pass-2 resolver traces imports, aliases, barrel re-exports, and tagged templates to produce accurate dependency edges), **community detection** (cluster membership), and **call-chain tracing** (process participation with entry/intermediate/exit roles).
 
+**Why it matters:**
+- **~100 tokens per symbol** vs. ~2,000 tokens to read the full file
+- Confidence-scored dependency edges trace real call relationships across files
+- Community detection and call-chain tracing reveal architectural structure
+- ETag-based conditional requests avoid re-fetching unchanged symbols
+
 [Indexing & Language Support Deep Dive →](./docs/feature-deep-dives/indexing-languages.md)
 
 ---
@@ -198,6 +208,12 @@ Instead of reading files in the same directory, SDL-MCP follows the *dependency
 
 Slices have handles, leases, refresh (delta-only updates), and spillover (paged overflow). You can also skip the symbol search entirely — pass a `taskText` string and SDL-MCP auto-discovers the relevant entry symbols.
 
+**Why it matters:**
+- Follows the **dependency graph**, not directory boundaries, for cross-cutting context
+- Weighted edge scoring (call > config > import) prioritizes the most relevant symbols
+- Token-budgeted: returns only what fits within your budget (~800 tokens vs. ~16,000 for raw files)
+- Natural-language task-text auto-discovers entry symbols — no symbol IDs needed
+
 [Graph Slicing Deep Dive →](./docs/feature-deep-dives/graph-slicing.md)
 
 ---
@@ -223,6 +239,12 @@ Slices have handles, leases, refresh (delta-only updates), and spillover (paged
 
 **PR risk analysis** (`sdl.pr.risk.analyze`) wraps this into a scored assessment with findings, evidence, and test recommendations. **Fan-in trend analysis** detects "amplifier" symbols whose growing dependency count means changes ripple further over time.
 
+**Why it matters:**
+- Semantic diffs show what a change **means**, not just what lines moved
+- Ranked blast radius identifies which dependent symbols are most at risk
+- Fan-in trend analysis detects "amplifier" symbols whose changes ripple further over time
+- PR risk scoring produces actionable findings with test re-run recommendations
+
 [Delta & Blast Radius Deep Dive →](./docs/feature-deep-dives/delta-blast-radius.md)
 
 ---
@@ -240,6 +262,11 @@ SDL-MCP doesn't wait for you to save. As you type in your editor, buffer updates
                                         LadybugDB (durable)
 ```
 
+**Why it matters:**
+- Search, cards, and slices reflect **unsaved editor changes** in real time
+- No manual re-index needed during active development
+- Background AST parsing with in-memory overlay keeps queries fast
+
 [Live Indexing Deep Dive →](./docs/feature-deep-dives/live-indexing.md)
 
 ---
@@ -255,6 +282,12 @@ Requests that don't meet policy are denied with actionable guidance ("try `getHo
 
 The sandboxed runtime execution tool (`sdl.runtime.execute`) has its own governance layer: disabled by default, executable allowlisting, CWD jailing, environment scrubbing, concurrency limits, and timeout enforcement.
 
+**Why it matters:**
+- Proof-of-need gating prevents agents from wastefully reading raw code
+- Denied requests include **actionable next-best-action** guidance
+- Full audit logging of every code access decision
+- Sandboxed runtime with executable allowlisting, CWD jailing, and environment scrubbing
+
 [Governance & Policy Deep Dive →](./docs/feature-deep-dives/governance-policy.md)
 
 ---
@@ -267,6 +300,11 @@ The feedback loop (`sdl.agent.feedback`) records which symbols were useful and w
 
 `sdl.context.summary` generates portable, token-bounded context briefings in markdown, JSON, or clipboard format for use outside MCP environments.
 
+**Why it matters:**
+- Autonomous task execution plans the **optimal Iris Gate path** within a token budget
+- Feedback loop records what was useful/missing, improving future slice quality
+- Portable context summaries export findings for use outside MCP environments
+
 [Agent Orchestration Deep Dive →](./docs/feature-deep-dives/agent-orchestration.md)
 
 ---
@@ -275,6 +313,12 @@ The feedback loop (`sdl.agent.feedback`) records which symbols were useful and w
 
 Run tests, linters, and scripts through SDL-MCP's governance layer instead of uncontrolled shell access. Three runtimes (Node.js, Python, Shell), code-mode or args-mode, smart output summarization with keyword-matched excerpts, and gzip artifact persistence.
 
+**Why it matters:**
+- Run tests, linters, and scripts **under governance** instead of uncontrolled shell access
+- 16 runtimes supported (Node, Python, Go, Java, Rust, Shell, and more)
+- Executable allowlisting, CWD jailing, timeout enforcement, and environment scrubbing
+- Smart output summarization with keyword-matched excerpts and gzip artifact persistence
+
 [Runtime Execution Deep Dive →](./docs/feature-deep-dives/runtime-execution.md)
 
 ---
@@ -302,6 +346,12 @@ Agents forget everything between sessions. SDL-MCP fixes this with a **graph-bac
 
 Memories are **automatically surfaced** inside graph slices — when an agent builds a slice touching symbols with linked memories, those memories appear alongside the cards. During re-indexing, memories linked to changed symbols are **flagged as stale**, prompting agents to review and update them. Four MCP tools (`store`, `query`, `remove`, `surface`) provide full CRUD plus intelligent ranking by confidence, recency, and symbol overlap.
 
+**Why it matters:**
+- Structured knowledge **persists across sessions**, linked directly to symbols and files
+- Automatically surfaced inside graph slices when touching related symbols
+- Stale memories flagged when linked symbols change during re-indexing
+- Dual storage: graph DB for fast querying + markdown files for version control and team sharing
+
 [Development Memories Deep Dive →](./docs/feature-deep-dives/development-memories.md)
 
 ---
@@ -323,6 +373,12 @@ echo '{"repoId":"my-repo"}' | sdl-mcp tool symbol.search --query "auth"
 
 Features include typed argument coercion (string, number, boolean, string[], json), budget flag merging, stdin JSON piping with CLI-flags-win precedence, auto-resolved `repoId` from cwd, four output formats (json, json-compact, pretty, table), typo suggestions, and per-action `--help`. The CLI dispatches through the same gateway router and Zod schemas as the MCP server — identical code paths, identical validation.
 
+**Why it matters:**
+- All MCP tool actions accessible from **any terminal** — no server, transport, or SDK required
+- Same code paths and Zod validation as the MCP server — identical behavior
+- Four output formats (json, json-compact, pretty, table) for scripting and CI pipelines
+- Auto-resolves repoId from cwd, supports stdin JSON piping and per-action `--help`
+
 [CLI Tool Access Deep Dive →](./docs/feature-deep-dives/cli-tool-access.md)
 
 ---
@@ -340,6 +396,12 @@ The tool gateway consolidates all 29 MCP tools into **4 namespace-scoped tools**
 
 Each gateway tool accepts an `action` discriminator field (e.g., `{ action: "symbol.search", repoId: "x", query: "auth" }`) and routes to the same handlers with double Zod validation. Thin wire schemas in `tools/list` keep the registration compact while full validation happens server-side. Legacy flat tool names are optionally emitted alongside for backward compatibility.
 
+**Why it matters:**
+- **81% token reduction** in `tools/list` overhead (~3,742 → ~713 tokens per conversation)
+- 29 tools consolidated into 4 namespace-scoped tools for simpler agent selection
+- Fewer tool choices means faster and more accurate tool dispatch by the agent
+- Backward-compatible: legacy flat tool names optionally emitted alongside
+
 [Tool Gateway Deep Dive →](./docs/feature-deep-dives/tool-gateway.md)
 
 <br/>

package/config/benchmark.ci.config.json

@@ -4,16 +4,16 @@
   "thresholds": {
     "indexing": {
       "indexTimePerFile": {
-        "maxMs": 2500,
+        "maxMs": 3000,
         "trend": "lower-is-better",
         "allowableIncreasePercent": 30,
-        "_comment": "Raised for LadybugDB graph backend: graph writes are inherently slower than SQLite inserts. CI runners see ~1500-1700ms per file."
+        "_comment": "Raised for LadybugDB graph backend: graph writes are inherently slower than SQLite inserts. CI runners see ~2000-2500ms per file."
       },
       "indexTimePerSymbol": {
-        "maxMs": 150,
+        "maxMs": 250,
         "trend": "lower-is-better",
         "allowableIncreasePercent": 30,
-        "_comment": "Raised for LadybugDB graph backend: per-symbol graph operations cost more than SQLite row inserts."
+        "_comment": "Raised for LadybugDB graph backend: per-symbol graph operations cost more than SQLite row inserts. CI runners see ~150-200ms per symbol."
       }
     },
     "quality": {

package/config/sdlmcp.config.example.json

@@ -39,7 +39,7 @@
     "maxWindowLines": 180,
     "maxWindowTokens": 1400,
     "requireIdentifiers": true,
-    "allowBreakGlass": true
+    "allowBreakGlass": false
   },
   "redaction": {
     "enabled": true,
@@ -137,6 +137,10 @@
     "writeQueueTimeoutMs": 30000,
     "toolQueueTimeoutMs": 30000
   },
+  "httpAuth": {
+    "enabled": true,
+    "token": null
+  },
   "codeMode": {
     "enabled": false,
     "exclusive": false,

package/config/sdlmcp.config.json

@@ -142,7 +142,7 @@
     "graphSliceMaxSizeBytes": 52428800
   },
   "semantic": {
-    "enabled": false,
+    "enabled": true,
     "alpha": 0.6,
     "provider": "mock",
     "model": "all-MiniLM-L6-v2",

package/config/sdlmcp.config.schema.json

@@ -145,7 +145,7 @@
         "maxWindowLines": 180,
         "maxWindowTokens": 1400,
         "requireIdentifiers": true,
-        "allowBreakGlass": true
+        "allowBreakGlass": false
       }
     },
     "redaction": {
@@ -263,7 +263,7 @@
           "type": "integer",
           "description": "Quiet-period threshold in milliseconds before idle checkpoint compaction runs",
           "minimum": 1000,
-          "maximum": 300000,
+          "maximum": 600000,
           "default": 15000
         },
         "maxDraftFiles": {
@@ -489,7 +489,7 @@
         "model": {
           "type": "string",
           "enum": ["all-MiniLM-L6-v2", "nomic-embed-text-v1.5"],
-          "default": "all-MiniLM-L6-v2"
+          "default": "nomic-embed-text-v1.5"
         },
         "modelCacheDir": {
           "type": "string",
@@ -581,7 +581,7 @@
         "enabled": true,
         "alpha": 0.6,
         "provider": "local",
-        "model": "all-MiniLM-L6-v2",
+        "model": "nomic-embed-text-v1.5",
         "generateSummaries": false,
         "summaryModel": "claude-haiku-4-5-20251001",
         "summaryMaxConcurrency": 5,
@@ -833,6 +833,27 @@
         "emitLegacyTools": true
       }
     },
+    "httpAuth": {
+      "type": "object",
+      "description": "HTTP transport authentication configuration — set a static bearer token or disable auth entirely",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "Enable bearer-token authentication for /mcp and /api/* endpoints",
+          "default": true
+        },
+        "token": {
+          "type": ["string", "null"],
+          "description": "Static bearer token. When null a random token is generated at startup.",
+          "minLength": 1,
+          "default": null
+        }
+      },
+      "default": {
+        "enabled": true,
+        "token": null
+      }
+    },
     "codeMode": {
       "type": "object",
       "description": "Code Mode configuration — batch multiple tool calls in a single chain with $N references between steps",

package/dist/agent/executor.d.ts

@@ -1,5 +1,8 @@
 import type { Action, AgentTask, Evidence, ExecutionMetrics, RungType } from "./types.js";
 import type { PolicyEngine } from "../policy/engine.js";
+import { evaluateRequest } from "../code/gate.js";
+/** Injectable gate evaluator for testability. */
+export type GateEvaluator = typeof evaluateRequest;
 export declare class Executor {
     private evidenceCapture;
     private actions;
@@ -7,21 +10,41 @@ export declare class Executor {
     private startTime;
     private policyEngine;
     private policyDecisions;
-    constructor(policyEngine?: PolicyEngine);
+    private gateEvaluator;
+    private connPromise;
+    constructor(policyEngine?: PolicyEngine, gateEvaluator?: GateEvaluator);
+    private getConn;
     execute(task: AgentTask, rungs: RungType[], context: string[]): Promise<{
         actions: Action[];
         evidence: Evidence[];
         success: boolean;
     }>;
+    private getNextEscalationRung;
     private executeRung;
+    /**
+     * Resolve file: context entries to symbol IDs by querying the DB.
+     */
+    private resolveFileSymbols;
+    /**
+     * Extract symbol IDs and file paths from context entries,
+     * resolving file: entries to their constituent symbol IDs.
+     */
+    private resolveContextToSymbols;
     private executeCardRung;
     private executeSkeletonRung;
     private executeHotPathRung;
     private executeRawRung;
+    /**
+     * Extract potential identifiers from task text for hot-path searching.
+     */
+    private extractIdentifiersFromTask;
     private generateActionId;
+    /**
+     * Returns a frozen snapshot of execution metrics computed at the end of
+     * the most recent `execute()` call. Calling this during execution will
+     * return stale data — use only after `execute()` resolves.
+     */
     getMetrics(): ExecutionMetrics;
-    getActions(): Action[];
-    getEvidence(): Evidence[];
     getNextBestAction(): string | undefined;
     reset(): void;
 }

package/dist/agent/executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/agent/executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EACN,SAAS,EACT,QAAQ,EACR,gBAAgB,EAChB,QAAQ,EACT,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EACV,YAAY,EAGb,MAAM,qBAAqB,CAAC;AAG7B,qBAAa,QAAQ;IACnB,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,OAAO,CAAgB;IAC/B,OAAO,CAAC,OAAO,CAAmB;IAClC,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,YAAY,CAA2B;IAC/C,OAAO,CAAC,eAAe,CAA0C;gBAErD,YAAY,CAAC,EAAE,YAAY;IAcjC,OAAO,CACX,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,QAAQ,EAAE,EACjB,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;YAY3D,WAAW;YAuCX,eAAe;YA0Cf,mBAAmB;YAsCnB,kBAAkB;YAsClB,cAAc;IAqF5B,OAAO,CAAC,gBAAgB;IAIxB,UAAU,IAAI,gBAAgB;IAM9B,UAAU,IAAI,MAAM,EAAE;IAItB,WAAW,IAAI,QAAQ,EAAE;IAIzB,iBAAiB,IAAI,MAAM,GAAG,SAAS;IAkBvC,KAAK,IAAI,IAAI;CAcd"}
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/agent/executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EACN,SAAS,EACT,QAAQ,EACR,gBAAgB,EAChB,QAAQ,EACT,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EACV,YAAY,EAGb,MAAM,qBAAqB,CAAC;AAM7B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAIlD,iDAAiD;AACjD,MAAM,MAAM,aAAa,GAAG,OAAO,eAAe,CAAC;AAmDnD,qBAAa,QAAQ;IACnB,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,OAAO,CAAgB;IAC/B,OAAO,CAAC,OAAO,CAAmB;IAClC,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,YAAY,CAA2B;IAC/C,OAAO,CAAC,eAAe,CAA0C;IACjE,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,WAAW,CAAkD;gBAEzD,YAAY,CAAC,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,aAAa;IActE,OAAO,CAAC,OAAO;IAOT,OAAO,CACX,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,QAAQ,EAAE,EACjB,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC;QACT,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IAkFF,OAAO,CAAC,qBAAqB;YAYf,WAAW;IA0CzB;;OAEG;YACW,kBAAkB;IA2BhC;;;OAGG;YACW,uBAAuB;YAqBvB,eAAe;YAiFf,mBAAmB;YAqFnB,kBAAkB;YAgElB,cAAc;IAwG5B;;OAEG;IACH,OAAO,CAAC,0BAA0B;IA6ClC,OAAO,CAAC,gBAAgB;IAIxB;;;;OAIG;IACH,UAAU,IAAI,gBAAgB;IAI9B,iBAAiB,IAAI,MAAM,GAAG,SAAS;IAgBvC,KAAK,IAAI,IAAI;CAiBd"}